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Abstract 

This paper uses evolutionary game theory to research the security investment issue of Cloud computing. First, under the 
premise of the bounded rationality of Cloud users, we set up evolutionary game model of Cloud computing security 
investment. And then, we investigate replicator dynamics and evolutionary stable strategies of Cloud user groups. The 
evolutionary game results can be applied to analyze the implementing process and predict the trends of changes of game part 
groups, and provide decision support for Cloud users about their Cloud computing security investment. 
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Introduction 

As cloud computing thrives, increasing enterprises and users are deploying their applications to the cloud. Cloud 
computing has become a new IT deployment pattern which can accelerate deployment of applications without 
consuming the computing resources of enterprises, and cloud users can dynamically scale the computing resources 
to applications as demand changes [1]. Despite those benefits, the architecture of cloud poses such a threat to the 
security of the existing technologies when deployed in a cloud environment [2]. The cloud is just built over the 
internet and all the concerns related to security in internet are also posed by the cloud. The basis of the cloud 
technology makes the consumer and provider reside at different location and virtually access the resources over 
the Internet. Even if enormous amount of security is put in place in the cloud, still the data is transmitted through 
the normal underlying Internet technology. So, the security concerns which are threatening the Internet also 
threaten the cloud [3]. 

Public clouds exhibit a unique type of interdependency because of the ability of an attacker to propagate his attack 
through the hypervisor to all VMs using the hypervisor [4]. In a dense network of clouds, an attacker may launch 
an indirect attack on a user's cloud-application by first compromising another user's cloud-application that is at the 
same hypervisor with the target application. Many users do not invest on Cloud application security due to higher 
investment costs and lower probability of Cloud computing security accident. This may create a risk connection 
among the users of a cloud where a part of cloud users who have safe applications deployed on the cloud will not 
use Cloud application service by reason of the risk imposed by another cloud user who does not make a security 
investment of their Cloud applications. That is to say that a user of a cloud cannot protect itself if other users are 
not doing the same. On the contrary, a user will not be suffered from Cloud security if it defends itself while other 
users are also making a Cloud security investment. So Cloud computing security investment is indispensable for 
each cloud user. 

However some Cloud users may consider that the probability of Cloud application security accident attacked by an 
attacker is lower, these users are reluctant to invest on Cloud application security with a higher investment costs. 


17 



www.seipub.org/ssmr 


Service Science and Management Research (SSMR) Volume 4, 2015 


This yields a negative externality to other Cloud users in the Cloud, and more Cloud users will adopt 'No 
Investment' strategy. Eventually the probability of Cloud application security accident will become higher and the 
interests of all Cloud users will be jeopardized. 

On account of strategy dependency of users' Cloud computing security investment, game theory can be applied to 
research the strategy issue of Cloud computing security investment. The players in game model of Cloud 
computing security investment have been assumed to have bounded rationality, so the paper uses evolutionary 
game theory to analyze strategy Selection of Cloud computing security investment. 

This paper mainly researches strategy issue of Cloud computing security investment from the perspective of 
evolutionary game theory and the rest of the paper is organized as follows. Section II will present evolutionary 
game model of Cloud computing security investment. Section III will detail replicator dynamics and evolutionary 
stable strategy analysis of cloud computing security investment, and predict the long-term stability trends of Cloud 
computing security investment. Finally, some conclusions in this paper and further research work will be 
presented in Section IV. 

Evolutionary Game Model of Cloud Computing Security Investment 

In real world, entirely rationality does not exist. There may be a greater bounded rationality especially when 
dealing with complex game problems. Evolutionary game theory with bounded rationality has provided a new 
way to explain complicated activities in social life. Cloud computing security investment is also a very complex 
problem, so investment decision often depends on gut instinct behaviors or imitation of other deciders' successful 
strategies, rather than optimization and game model analysis. So this paper, based on the bounded rationality of 
investors, sets up evolutionary game model of Cloud computing security investment. 

In this game mode, the two players are assumed to have bounded rationality, which means each player has not a 
full understanding of the game and has the ability to take the actions that maximize his expected payoff through 
rational analysis. A strategy is a rule for choosing which action to perform. Each player has two strategies: 
investment and no investment, which means they can either invest in Cloud computing security to increase their 
application security deployed on the Cloud or not do. 

Then we can refer to some parameters as follows. B is the benefit of user, which is independent of benefit of Cloud 
computing security investment. C represents investment costs for Cloud computing security. L is the lost from 
Cloud computing security issue and the loss probability, whether users have invested Cloud computing security or 
not, is q x and the loss probability caused by other users is q 2 which represents negative externalities among the 
Cloud computing users, and the loss probability caused by the user himself is denoted q 2 . The last parameter I 
stands for intangible benefit from the security investment of Cloud computing. 


TABLE I THE PAY-OFF MATRIX OF GAME MODEL OF CLOUD COMPUTING SECURITY INVESTMENT 


Playerl 

Player2 

Investment 

No Investment 

Investment 

B-C-qjL+I, B-C-qjL+I 

B-C-qjL^L+I, B-q 2 L 

No 

Investment 

B-q 2 L, B-C-q 1 L-q 3 L+I 

B -c hL"(l _c h MsCB'CpIAl _c h 


Evolutionary game of Cloud computing security investment is visually represented as a payoff matrix as shown in 
Table 1, in which the payoff for the user involved is shown for all possible interactions. If the two players both 
invest Cloud computing security, the payoffs of them are B-C-q^+I . Instead, if neither of the two players invest 
Cloud computing security, each of them has own security risks with the probability q 3 and negative externalities 
caused by other users with the probability q 2 , and thus the payoffs of them are B-q 2 L-(l-q 2 )q 3 L . If the strategy of 
player 1 is investment, and encounters that player 2 chooses 'no investment', the payoff for player 1 
is B-C-q 1 L-q 3 L+I and for player 2 is B-q 2 L . 
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Replicator Dynamics and ESS Analysis of Cloud Security Investment 

1) Replicator Dynamics of Evolutionary Game of Cloud Computing Security Investment 

In mathematics, the replicator equation is a deterministic monotone non-linear and non-innovative game 
dynamic used in evolutionary game theory and can reasonably characterize the stability of bounded rationality 
game party through dynamic learning and adjustment [5]. The two players in game model of Cloud computing 
security investment have been assumed to have bounded rationality, so the replicator dynamics model can be 
applied to analyze the implementing process and predict the trends of changes of game part groups, and put 
forward for the reasonable macro control of Cloud computing security issue. 

In this game model, we consider that the proportion of the players with the strategy of investing in cloud 
computing security is denoted x, and the proportion of no investment strategy is 1-x. we set Ui as the expected 
payoffs of game party adopting investment strategy in this game model: 

= jtCjj — C — q^L 4- _T) 4- 
(1 - j) (X - C ~ q ± L -<?/+_/-) (1) 

u 2 is the expected payoffs of game party adopting no investment strategy in security investment model of 
Cloud computing: 

Uj, = s{B - q 2 L) + 

(1 - x) LB - q 2 L - Cl - <?,)<?/] (2) 

Thus, the overall average expected payoffs u can be deduced as follows, 

u = + (1 — t)u 2 ( 3) 

From equation (1) to (3), we have the expression of replicator dynamics of Cloud computing security 
investment: 


= jtCl? — l?) = -v(l — _y) * 

dt 1 

+ <? 2 )L + J — C — (4) 

We suppose that replicator dynamics of evolutionary game of Cloud computing security investment is equals to 
zero: 


x(l - x) Iq 2 q z Lx 4- (q ± + q 2 )L + 

I -C - = 0 (5) 

So through solving this replicator dynamics equation, three stable states can be deduced as follows: 

C + q z q s L ~ + q z )L - I 

x 2 = 0 and * 3 = 1 

2) Evolutionary Stable Strategy Analysis of Game Model 

An evolutionarily stable strategy (ESS) is a strategy that cannot be invaded by another strategy and can be used 
to predict long-term stable trend of game group behavior [6]. This means that, if the proportion of adopting 
investment strategy is less than ESS, then the value of must be greater than 0. If x is greater than ESS, then the 
value of must be less than 0. So we can conclude that if satisfied, the proportion of adopting investment strategy 
is an evolutionary stable strategy. 

Setting f(x)=dx/dt and x^a . According to (4), we can get 
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f(x)= dxldt = x(l-x)(x-x } ) 

~-X^ +(x i +l)x 2 -x i x 
=> / (x) — ( ix/dt) '—-3 x 2 +2( x, +1)?:- x. 

When x =0 and x=l , the corresponding value of is - and -1 respectively as follows: 


f 00'- 


-X, 


x=0 


Xj-1 x=l 


When x is an ESS. Thus, we can conclude whether the proportion of adopting investment strategy is an 
evolutionary stable strategy. Evolutionary stable strategy (ESS) depends on the value of 


x. = 


C + q 2 q s L - + g a )X - I 




X 

so we analyze ESS of Cloud computing security investment game according to the range of values for 1 . 

■ Evolutionary stable strategy under given, that means. As x ranges from 0 to 1, the replicator-dynamics of 
Cloud computing security investment evolutionary game include two stable states with x 2 = 0 and x 3 =l . 

According to formula (5) and the condition, we have f (0)>0 and f (1)<0 , so x 3 =1 is the unique ESS 

of evolutionary game of Cloud computing security investment. Because of lower investment cost of Cloud 
computing security, all users will be willing to adopt Cloud computing security investment strategy. 



FIG 1. THE PHASE DIAGRAM OF REPLICATOR DYNAMICS EQUATION UNDER x l < 0 
■ Evolutionary stable strategy under 0 < x x < 1 

Given 0<x 1 <l , that means (q 1 +q 2 )L+I-q 2 q 3 L< C< (q 1 +q 2 )L+I . In this condition, there are three stable 
strategies of replicator dynamics, i.e. 

C + q 2 q s L - (q 1 + q 2 )L - I 

X 1 ~ r 

x 2 = Ocmdx, = 1 

According to formula (5) and the condition 0 < x x < 1 , we have f (0)<0 and f (1)0 . As indicated in Figure 2, the 
phase diagram of replicator dynamics equation under 0 < x l < 1 shows that the ESSs 
under 0 < x l < 1 are x 2 = 0 and x 3 = 1 . In this condition, if the initial proportion(x) of adopting Cloud computing 
security investment strategy ranges from 0 to x x , 0 is the evolutionary stable strategy (ESS); if x ranges from x, to 
1, 1 is ESS that means all players would adopt Cloud computing security investment strategy. 
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FIG 2. THE PHASE DIAGRAM OF REPLICATOR DYNAMICS EQUATION UNDER 0 < jq < 1 

3) Evolutionary Stable Strategy Under x x > 1 

Given 1 , that means C > (q 1 +q 2 )L+I . In this condition, there are only two evolutionary stable strategies of 
replicator dynamics, i.e. x 2 = 0 and x 3 = 1 . According to formula (5) and the condition x, > 1 , we have f (0)<0 
and f (1)>0 . As indicated in Figure 3, the phase diagram of replicator dynamics equation under x l > 1 shows that 
the unique ESS under x l > 1 is x 2 = 0 . In this condition, because the investment cost of Cloud computing security 
is higher, therefore the users are reluctant to invest in Cloud computing security during the long-term 
evolution. In order to reduce security risks of using Cloud computing, crucially. Cloud computing security 
technology must be developed to improve the safety of Cloud computing and lower the investment cost of 
Cloud computing security. 



FIG 3. THE PHASE DIAGRAM OF REPLICATOR DYNAMICS EQUATION UNDER jq > 1 


Conclusions 

This paper mainly researches strategy issue of Cloud computing security investment with evolutionary game 
theory. Considering the bounded rationality of Cloud users in reality, we build evolutionary game model of Cloud 
computing security investment. And we investigate evolutionary stable strategies of Cloud user groups under 
three different conditions using replicator dynamics theory. The research result shows that the investment costs of 
Cloud computing security is crucial element for Cloud users to strategy selection and can predict the long-term 
trend of Cloud security investment strategy for Cloud users and provide a reference for Cloud computing security 
investment of Cloud users. For future work we intend to simulate this evolutionary game with simulation software 
to verify the evolutionary stable strategy. 
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